you guys will like this

VooDoo · Post by **VooDoo** » Mon Mar 03, 2003 1:01 pm

my sister-in-law was d/l mp3s with kazaa and when the d/l was done

the mp3 played just fine but after a wile the mp3 would be turned into a vbs file

and the mp3 gone

its been happening for a long time (unknown how long)

after racking my head for about a hour id d/l some of new ones and just like be for

they would be turned in vbs files then i instaled (yes, i said installed) norton then

oh my god
total files: 43995
total infected: 10593

with the VBS.LOVELETTER.A virus

i just started laughing, then for kicks i unhid all the files and what did i find, the mp3s

from what i saw is the virus takes the name of the mp3 and creats

a file with the same name and hides the mp3 so he is goin the format tonight but

he wont be home till 4:00pm (central) it infected mostly in his internet temp dir and some his dark age dir

i deleted the temps dirs then i rescaned and it found them again (yes, i empty it befor i rescaned)

help

me

blade · Post by **blade** » Mon Mar 03, 2003 1:20 pm

This is a nasty one.

First try this fix:
http://www.sarc.com/avcenter/venc/data/ ... etter.html
Read that and scroll down for the fix. Hope it works for you.

However:

<i>This tool will have limited effectiveness if you have been infected with VBS.NewLove.A. This variant of LoveLetter destroys all files on the system that are not in use. Therefore an infected system will most likely be unstable.</i>

Yours appears to not be that variant so hopefully the fix will work. More details on that virus here:
http://www.symantec.com/avcenter/venc/d ... ter.a.html

<b>CAUTION: Do not attempt to run files that have been overwritten or renamed by this worm. If you do, the worm is executed again.</b>

If that fails then try this free online virus scanner:
http://housecall.antivirus.com/housecall/start_corp.asp

If that all fails, it looks like it may be format time.

But I'd also try the http://www.grisoft.com av too, if it will let you.

Good luck.

wvjohn · Post by **wvjohn** » Mon Mar 03, 2003 1:55 pm

YIKES

VooDoo · Post by **VooDoo** » Mon Mar 03, 2003 4:36 pm

thank blade

ok i got the file lovefix

and ran it it found it and removed it

rebooted

but norton still finds the dirs that are gone

anything else

me